Sub-processor List

Draft – For Legal Review

Last updated: 14 June 2026

Published under clause 5 of the Data Processing Addendum

1. About this list

This list names the third parties we engage to help deliver the Software, as required by clause 5 of the Data Processing Addendum. Each one is bound by confidentiality and data protection obligations no less protective than those we owe you. We will give you notice of any new or replacement sub-processor before it begins processing Customer Data, so that you have the opportunity to object.

Hosting locations are stated as they actually are today. Where a provider processes data outside Australia we say so plainly, because that is a cross-border disclosure under Australian Privacy Principle 8.

2. Platform hosting and database

Emergent (Emergent Labs, Inc.) — application hosting, Kubernetes compute, container storage and the managed MongoDB database that holds your assessments, evidence, risks, documents and user accounts. Hosted in the United States. This is the only sub-processor that holds the full set of Customer Data.

Cloudflare, Inc. — DNS, TLS termination, content delivery and denial-of-service protection for the website and application. Globally distributed edge; traffic metadata only, including IP addresses and request paths.

3. Email delivery

Google LLC (Google Workspace SMTP relay) — delivery of transactional and notification email, including sign-in alerts, invitations, assessor share links, board digests and administrator broadcasts. Hosted in the United States. Processes recipient name, email address and the content of the message sent.

Resend, Inc. — alternative transactional email delivery, used only where a deployment is configured to use it instead of the SMTP relay. Hosted in the United States. Same data as above.

4. Payments

Stripe, Inc. (including Stripe Payments Australia Pty Ltd) — subscription billing, card processing and invoicing. Hosted in the United States and Australia. Processes billing contact name, email, company name, subscription tier and payment details. Card numbers are entered directly with Stripe and never reach our systems.

PayPal Pte. Ltd. / PayPal, Inc. — alternative payment method where a customer chooses to pay by PayPal. Hosted in the United States and Singapore. Processes billing contact details and transaction amounts only.

5. Optional artificial-intelligence providers

Where your workspace chooses to connect an AI provider, you supply your own API key and you decide which provider to use. Control text and the context you select are sent to that provider to generate advice. We do not send Customer Data to any AI provider unless your workspace has connected one. The providers you may select are OpenAI, L.L.C., Anthropic, PBC and Google LLC (Gemini), each hosted in the United States. Disconnecting the provider stops all such processing immediately.

6. Sub-processors you control

If your organisation uses single sign-on, your identity provider (for example Google) processes your users' sign-in events under your own agreement with that provider, not ours.

7. Self-hosted and sovereign deployments

Where the Software is deployed into your own environment — including air-gapped and sovereign installations — none of the sub-processors in sections 2 to 5 apply except those your deployment is configured to use. In that case hosting, database, email and backup are entirely within your infrastructure and your control.

8. Changes and notification

We review this list whenever our supply chain changes and at least annually. Material changes are announced in the product change log and, where they affect Customer Data, notified to workspace administrators by email.

9. Contact

Questions or objections about any sub-processor should be sent to the contact address in our Privacy Policy. Governing law: South Australia, Australia.